EUVD-2026-44801Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because exploitation requires intimate knowledge and total control of the tunnel protocol; network-reachable with availability-only impact, so C:N/I:N/A:H.
Primary rating from Vendor (Absolute).
CVSS VectorVendor: Absolute
Lifecycle Timeline
3DescriptionCVE.org
CVE-2026-33445 is a memory management vulnerability in Secure Access servers prior to 14.55. Attackers with an intimate knowledge of and total control over the tunnel protocol can create a persistent DoS against the server.
AnalysisAI
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows a remote attacker with deep, low-level command of the tunnel protocol to corrupt server-side memory management and keep the server down. The flaw carries a CVSS 4.0 base score of 8.7 driven entirely by an availability (VA:H) impact, with no confidentiality or integrity consequence. No public exploit identified at time of analysis and it is not listed in CISA KEV, so real-world exploitation appears unproven.
Technical ContextAI
Absolute Secure Access (the enterprise secure-connectivity/VPN platform formerly known as NetMotion Mobility) terminates client sessions over a proprietary tunnel protocol. The defect is a memory-management error in the server's handling of that tunnel protocol: malformed or precisely manipulated protocol state exhausts or corrupts memory such that the condition persists rather than self-recovering. No CWE was assigned in the source data, but the described behavior (memory-management fault reachable through protocol handling leading to a durable crash/hang) is consistent with the CWE-400/CWE-401/CWE-404 class (uncontrolled resource consumption / improper resource release) rather than a memory-safety code-execution bug, which aligns with the availability-only CVSS impact. The single affected component is identified by cpe:2.3:a:absolute_security:secure_access:*, i.e. the Secure Access server application across all versions prior to the 14.55 fix.
RemediationAI
Upgrade Absolute Secure Access servers to version 14.55 or later, which is the vendor-released patch (affected = prior to 14.55); consult the advisory at https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-33445 for the exact build and upgrade guidance. Until patching is complete, reduce exposure by restricting network reachability of the tunnel service to known client IP ranges or placing it behind an upstream filtering layer, and monitor for repeated server crashes, memory exhaustion, or tunnel restarts as an early indicator of exploitation; note that IP restrictions can break roaming or remote users who connect from arbitrary networks, which is the core use case of the product, so treat this as a stopgap rather than a durable control. Because the impact is a persistent DoS, ensure server high-availability/failover and rapid restart automation are in place to limit outage duration if the condition is triggered.
More in Secure Access
View allPersistent denial-of-service in Absolute Security Secure Access servers prior to version 14.57 is achievable by network
Local privilege escalation in Absolute Secure Access for Windows (client and server) before version 14.55 allows a low-p
Local privilege escalation in Absolute Secure Access Windows client versions prior to 14.50 allows authenticated local a
Memory management vulnerability in Absolute Secure Access server versions 9.0 through 13.54 that allows unauthenticated,
Secure Access Server versions before 14.20 are vulnerable to a network-based denial-of-service attack where unauthentica
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows an authenticated tunnel parti
Buffer overflow in Absolute Secure Access server (versions before 14.50) allows authenticated remote attackers with modi
Null dereference in the load-balancing subsystem of Absolute Secure Access servers (prior to 14.57) allows unauthenticat
Non-persistent denial-of-service against Absolute Secure Access servers prior to version 14.55 is achievable by an attac
Memory management flaw in Absolute Secure Access prior to version 14.55 allows a remote attacker with deep protocol know
Memory corruption in Absolute Secure Access Windows clients prior to version 14.50 allows local authenticated attackers
Buffer overflow in Absolute Secure Access Windows client versions prior to 14.50 allows local attackers with high privil
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today